Enterprise Open-Source IT Stack Deployment Guide¶

┌─────────────────────────────────────────────────────────────────┐
│                         Internet/WAN                             │
└────────────────────────┬────────────────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────────────────┐
│                 Edge Firewall Layer (pfSense)                    │
│  • IDS/IPS (Suricata)  • VPN (WireGuard/OpenVPN)                │
│  • Traffic Shaping     • DDoS Protection                         │
└────────────────────────┬────────────────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────────────────┐
│         Reverse Proxy & Load Balancer (HAProxy/Traefik)         │
│  • SSL/TLS Termination  • Load Distribution                     │
│  • Web Application Firewall  • Certificate Management           │
└────────────────────────┬────────────────────────────────────────┘
                         │
        ┌────────────────┼────────────────┐
        │                │                │
┌───────▼──────┐  ┌─────▼─────┐  ┌──────▼──────┐
│ DMZ Services │  │  App Tier  │  │  Data Tier  │
└──────────────┘  └────────────┘  └─────────────┘

CPU: 2x Intel Xeon Gold 6338 (32 cores / 64 threads each) or AMD EPYC 7543
RAM: 256 GB DDR4-3200 ECC (expandable to 512 GB)
Storage: 
  - 2x 960GB NVMe SSD (RAID 1) - OS/System
  - 4x 3.84TB NVMe SSD (RAID 10) - Application Data
Network: 
  - 4x 10GbE ports (bonded/redundant)
  - 2x 1GbE IPMI/Management
RAID: Hardware RAID controller with 2GB cache, BBU
Power: Dual redundant PSU (Platinum efficiency)

CPU: 1x Intel Xeon Silver 4314 or AMD EPYC 7313P
RAM: 128 GB DDR4-3200 ECC
Storage:
  - 2x 480GB SSD (RAID 1) - OS
  - 12x 8TB HDD (RAIDZ2) - Data pool
  - 2x 1.92TB NVMe - Cache/Log
Network: 4x 10GbE ports
HBA: LSI 9305-16i or equivalent
Power: Dual redundant PSU

CPU: 2x Intel Xeon Gold 6338 or AMD EPYC 7543
RAM: 512 GB DDR4-3200 ECC
Storage:
  - 2x 960GB NVMe (RAID 1) - OS
  - 6x 3.84TB NVMe (RAID 10) - Database
Network: 4x 10GbE + 2x 25GbE (cluster interconnect)
RAID: Hardware RAID with 4GB cache, BBU
Power: Dual redundant PSU

Platform: Netgate 6100 or build custom pfSense appliance
CPU: 8-core Intel Atom C3000 or better
RAM: 16 GB
Storage: 128 GB M.2 SSD
Ports: 8x 10GbE SFP+, 4x 1GbE RJ45
Throughput: 10+ Gbps with IDS/IPS enabled

Type: Enterprise managed 10GbE switch
Ports: 48x 10GbE SFP+ + 6x 40GbE QSFP+
Features: L3 routing, LACP, VLAN, QoS, redundant PSU
Backplane: 1.28 Tbps
Example: Arista 7050SX or equivalent

Type: Managed 1GbE/2.5GbE switch
Ports: 48x 1GbE/2.5GbE + 4x 10GbE SFP+ uplink
Features: VLAN, PoE+ (for WiFi APs), LACP
Example: Ubiquiti UniFi Switch Pro or equivalent

VLAN 10: Management (172.16.10.0/24)
VLAN 20: Server Infrastructure (172.16.20.0/24)
VLAN 30: Database Backend (172.16.30.0/24)
VLAN 40: Storage Network (172.16.40.0/24)
VLAN 50: Office Staff (172.16.50.0/23)
VLAN 60: VoIP/Video (172.16.60.0/24)
VLAN 70: Guest/Contractor (172.16.70.0/24)
VLAN 80: IoT/Devices (172.16.80.0/24)
VLAN 99: DMZ (192.168.99.0/24)

                          Internet (Public IPs)
                                  │
                   ┌──────────────┴──────────────┐
                   │   Edge Firewall/Router      │
                   │  (pfSense/OPNsense)         │
                   │  • NAT                      │
                   │  • IDS/IPS (Suricata)       │
                   │  • VPN Server (WireGuard)   │
                   └──────────────┬──────────────┘
                                  │
                   ┌──────────────┴──────────────┐
                   │  Core L3 Switch             │
                   │  Inter-VLAN Routing         │
                   └──────────────┬──────────────┘
                                  │
         ┌────────────────────────┼────────────────────────┐
         │                        │                        │
    ┌────▼────┐            ┌──────▼──────┐         ┌──────▼──────┐
    │ VLAN 99 │            │  VLAN 20    │         │  VLAN 50    │
    │   DMZ   │            │  Servers    │         │   Clients   │
    └─────────┘            └─────────────┘         └─────────────┘
         │                        │
    ┌────▼────────┐        ┌──────▼──────────┐
    │ Traefik     │        │ Application     │
    │ HAProxy     │        │ Servers         │
    │ WAF         │        │ - Nextcloud     │
    └─────────────┘        │ - Mattermost    │
                           │ - Keycloak      │
                           │ - Jitsi         │
                           │ - Zammad        │
                           └─────────────────┘

ALLOW tcp/443 (HTTPS) → Reverse Proxy
ALLOW tcp/80 (HTTP - redirect to 443) → Reverse Proxy
ALLOW udp/10000 (Jitsi video) → JVB
ALLOW tcp/5349 (TURNS) → Jitsi
ALLOW tcp/443 (VPN) → WireGuard/OpenVPN
DENY all other

ALLOW tcp/443,80 → Application servers (Nextcloud, Mattermost, etc.)
ALLOW tcp/8443 → Keycloak
ALLOW tcp/5222,5280 → Prosody (Jitsi signaling)
DENY all other

ALLOW tcp/5432 → PostgreSQL
ALLOW tcp/3306 → MariaDB
ALLOW tcp/6379 → Redis
DENY all other

ALLOW tcp/443 → All web services
ALLOW tcp/587,993 → Mail (SMTP submission, IMAP)
ALLOW tcp/5222 → XMPP (Jitsi)
ALLOW established/related
DENY all other

Domain: company.internal
NS Records: ipa1.company.internal, ipa2.company.internal

# Service Records
mail.company.internal       → 172.16.20.10 (iRedMail)
cloud.company.internal      → 172.16.20.20 (Nextcloud)
chat.company.internal       → 172.16.20.30 (Mattermost)
meet.company.internal       → 172.16.20.40 (Jitsi)
desk.company.internal       → 172.16.20.50 (Zammad)
sso.company.internal        → 172.16.20.60 (Keycloak)

Domain: company.com

# Public A Records
mail.company.com           → <Public IP 1>
cloud.company.com          → <Public IP 1>
chat.company.com           → <Public IP 1>
meet.company.com           → <Public IP 1>
desk.company.com           → <Public IP 1>
vpn.company.com            → <Public IP 1>

# MX Records
company.com   MX 10 mail.company.com

# SPF Record
company.com   TXT "v=spf1 mx ip4:<Public IP 1> -all"

# DMARC Record
_dmarc.company.com  TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@company.com"

# DKIM Record
default._domainkey.company.com  TXT "v=DKIM1; k=rsa; p=<public-key>"

# SRV Records (Jitsi)
_turns._tcp.company.com  SRV 5 0 5349 meet.company.com

/etc/ssl/certs/company.com/          # Primary cert directory
├── fullchain.pem                    # Full certificate chain
├── privkey.pem                      # Private key
├── cert.pem                         # Server certificate
└── chain.pem                        # Intermediate chain

vCPU: 2
RAM: 4 GB
Disk: 50 GB
OS: Ubuntu 24.04 LTS / Rocky Linux 9
Examples: Monitoring agents, log collectors

vCPU: 4-8
RAM: 8-16 GB
Disk: 100-200 GB
OS: Ubuntu 24.04 LTS / Rocky Linux 9
Examples: Nextcloud, Mattermost, Keycloak, Jitsi

vCPU: 8-16
RAM: 32-64 GB
Disk: 500 GB - 1 TB (SSD/NVMe)
OS: Ubuntu 24.04 LTS / Rocky Linux 9
Examples: PostgreSQL, MariaDB, Elasticsearch

# Edit /etc/netplan/50-cloud-init.yaml
sudo nano /etc/netplan/50-cloud-init.yaml

network:
  version: 2
  ethernets:
    ens18:
      dhcp4: no
      addresses:
        - 172.16.20.XX/24  # Adjust per server
      gateway4: 172.16.20.1
      nameservers:
        addresses:
          - 172.16.20.5   # FreeIPA server
          - 172.16.20.6   # FreeIPA replica
          - 1.1.1.1       # Fallback
        search:
          - company.internal

# Apply configuration
sudo netplan apply

# Verify
ip addr show
ping -c 3 google.com

# Set hostname
sudo hostnamectl set-hostname ipa1.company.internal

# Update /etc/hosts
sudo nano /etc/hosts

127.0.0.1 localhost
172.16.20.5 ipa1.company.internal ipa1

# FreeIPA servers
172.16.20.5 ipa1.company.internal ipa1
172.16.20.6 ipa2.company.internal ipa2

# Install FreeIPA server
sudo apt install -y freeipa-server freeipa-server-dns

# Run installation wizard
sudo ipa-server-install \
  --domain=company.internal \
  --realm=COMPANY.INTERNAL \
  --ds-password='<Directory Manager Password>' \
  --admin-password='<Admin Password>' \
  --hostname=ipa1.company.internal \
  --ip-address=172.16.20.5 \
  --setup-dns \
  --forwarder=1.1.1.1 \
  --forwarder=8.8.8.8 \
  --reverse-zone=20.16.172.in-addr.arpa. \
  --no-ntp \
  --unattended

# Firewall configuration
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 389/tcp
sudo ufw allow 636/tcp
sudo ufw allow 88/tcp
sudo ufw allow 88/udp
sudo ufw allow 464/tcp
sudo ufw allow 464/udp
sudo ufw allow 123/udp
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw enable

# Obtain Kerberos ticket
kinit admin
klist

# Set hostname
sudo hostnamectl set-hostname ipa2.company.internal

# Update /etc/hosts (same as Server 1)

# Install FreeIPA client first
sudo apt install -y freeipa-client

# Join domain
sudo ipa-client-install \
  --domain=company.internal \
  --realm=COMPANY.INTERNAL \
  --server=ipa1.company.internal \
  --principal=admin \
  --password='<Admin Password>' \
  --mkhomedir \
  --unattended

# Install replica packages
sudo apt install -y freeipa-server freeipa-server-dns

# Set up replica
sudo ipa-replica-install \
  --setup-dns \
  --forwarder=1.1.1.1 \
  --forwarder=8.8.8.8 \
  --no-ntp \
  --unattended

# Configure firewall (same as Server 1)

# Authenticate
kinit admin

# Create service accounts for applications
ipa user-add keycloak --first=Keycloak --last="Service Account" --email=keycloak@company.internal
ipa user-add nextcloud --first=Nextcloud --last="Service Account" --email=nextcloud@company.internal
ipa user-add mattermost --first=Mattermost --last="Service Account" --email=mattermost@company.internal

# Create groups
ipa group-add --desc="Back Office Staff" office-staff
ipa group-add --desc="Security Guards" guards
ipa group-add --desc="IT Administrators" it-admins
ipa group-add --desc="Managers" managers

# Set group policies (HBAC)
ipa hbacrule-add allow_all_services
ipa hbacrule-add-service allow_all_services --hbacsvcs=sshd
ipa hbacrule-add-user allow_all_services --groups=it-admins

# Install PostgreSQL
sudo apt install -y postgresql-16 postgresql-contrib

# Configure PostgreSQL
sudo -u postgres psql

CREATE DATABASE keycloak;
CREATE USER keycloak WITH ENCRYPTED PASSWORD '<keycloak-db-password>';
GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
\q

# Allow remote connections
sudo nano /etc/postgresql/16/main/pg_hba.conf

host    keycloak    keycloak    172.16.20.0/24    scram-sha-256

# Restart PostgreSQL
sudo systemctl restart postgresql

# Install Java 17
sudo apt install -y openjdk-17-jdk

# Download Keycloak
cd /opt
sudo wget https://github.com/keycloak/keycloak/releases/download/24.0.0/keycloak-24.0.0.tar.gz
sudo tar -xzf keycloak-24.0.0.tar.gz
sudo mv keycloak-24.0.0 keycloak
sudo chown -R root:root /opt/keycloak

# Create Keycloak user
sudo useradd -r -s /bin/false keycloak
sudo chown -R keycloak:keycloak /opt/keycloak

# Configure database
sudo nano /opt/keycloak/conf/keycloak.conf

# Database configuration
db=postgres
db-url=jdbc:postgresql://172.16.30.10:5432/keycloak
db-username=keycloak
db-password=<keycloak-db-password>

# HTTP/HTTPS configuration
hostname=sso.company.com
http-enabled=true
http-port=8080
https-port=8443
proxy=edge

# Clustering (for HA)
cache=ispn
cache-stack=tcp

# Build Keycloak
cd /opt/keycloak
sudo -u keycloak ./bin/kc.sh build

# Create systemd service
sudo nano /etc/systemd/system/keycloak.service

[Unit]
Description=Keycloak Application Server
After=network.target postgresql.service

[Service]
Type=idle
User=keycloak
Group=keycloak
ExecStart=/opt/keycloak/bin/kc.sh start
ExecStop=/opt/keycloak/bin/kc.sh stop
Restart=on-failure
RestartSec=10s
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

# Enable and start
sudo systemctl daemon-reload
sudo systemctl enable keycloak
sudo systemctl start keycloak

# Check status
sudo systemctl status keycloak
sudo journalctl -u keycloak -f

# Create admin user
cd /opt/keycloak
sudo -u keycloak ./bin/kcadm.sh config credentials \
  --server http://localhost:8080 \
  --realm master \
  --user admin \
  --password <admin-password>

# Install Docker
sudo apt update
sudo apt install -y docker.io docker-compose
sudo systemctl enable docker
sudo systemctl start docker

# Create Traefik directory structure
sudo mkdir -p /opt/traefik/{config,certs,logs}
cd /opt/traefik

version: '3.8'

services:
  traefik:
    image: traefik:v2.11
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
    environment:
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}  # For Cloudflare DNS challenge (if used)
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./config:/config:ro
      - ./certs:/certs
      - ./logs:/logs
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=https"
      - "traefik.http.routers.traefik.rule=Host(`traefik.company.com`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$..."  # htpasswd hash

networks:
  proxy:
    external: true

api:
  dashboard: true
  insecure: false

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
  https:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt

certificatesResolvers:
  letsencrypt:
    acme:
      email: admin@company.com
      storage: /certs/acme.json
      httpChallenge:
        entryPoint: http
      # For wildcard certs, use DNS challenge:
      # dnsChallenge:
      #   provider: cloudflare
      #   resolvers:
      #     - "1.1.1.1:53"
      #     - "8.8.8.8:53"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: proxy
  file:
    directory: /config
    watch: true

log:
  level: INFO
  filePath: /logs/traefik.log
  format: json

accessLog:
  filePath: /logs/access.log
  format: json
  filters:
    statusCodes:
      - "400-499"
      - "500-599"

sudo nano /opt/traefik/config/backends.yml

http:
  routers:
    nextcloud:
      rule: "Host(`cloud.company.com`)"
      entryPoints:
        - https
      service: nextcloud
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers
        - rate-limit

    mattermost:
      rule: "Host(`chat.company.com`)"
      entryPoints:
        - https
      service: mattermost
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers

    jitsi:
      rule: "Host(`meet.company.com`)"
      entryPoints:
        - https
      service: jitsi
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers

    keycloak:
      rule: "Host(`sso.company.com`)"
      entryPoints:
        - https
      service: keycloak
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers

    zammad:
      rule: "Host(`desk.company.com`)"
      entryPoints:
        - https
      service: zammad
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers

  services:
    nextcloud:
      loadBalancer:
        servers:
          - url: "http://172.16.20.20:80"
        healthCheck:
          path: /status.php
          interval: "10s"
          timeout: "3s"

    mattermost:
      loadBalancer:
        servers:
          - url: "http://172.16.20.30:8065"
        healthCheck:
          path: /api/v4/system/ping
          interval: "10s"

    jitsi:
      loadBalancer:
        servers:
          - url: "http://172.16.20.40:80"

    keycloak:
      loadBalancer:
        servers:
          - url: "http://172.16.20.60:8080"
          - url: "http://172.16.20.61:8080"
        healthCheck:
          path: /health
          interval: "10s"

    zammad:
      loadBalancer:
        servers:
          - url: "http://172.16.20.50:3000"

  middlewares:
    security-headers:
      headers:
        customResponseHeaders:
          X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"
          server: ""
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        frameDeny: true
        contentTypeNosniff: true
        browserXssFilter: true
        referrerPolicy: "same-origin"
        customFrameOptionsValue: "SAMEORIGIN"

    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1m

# Create Docker network
sudo docker network create proxy

# Set permissions
sudo chmod 600 /opt/traefik/certs
sudo touch /opt/traefik/certs/acme.json
sudo chmod 600 /opt/traefik/certs/acme.json

# Start Traefik
sudo docker-compose up -d

# Check logs
sudo docker-compose logs -f

# Install PostgreSQL 16
sudo apt install -y postgresql-16 postgresql-contrib
sudo systemctl enable postgresql

# Install Patroni for HA
sudo apt install -y python3-pip python3-psycopg2
sudo pip3 install patroni[etcd] python-etcd

# Install etcd (distributed configuration store)
sudo apt install -y etcd

# /etc/default/etcd
ETCD_NAME="db1"  # Change per node
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_CLIENT_URLS="http://172.16.30.10:2379"
ETCD_ADVERTISE_CLIENT_URLS="http://172.16.30.10:2379"
ETCD_LISTEN_PEER_URLS="http://172.16.30.10:2380"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://172.16.30.10:2380"
ETCD_INITIAL_CLUSTER="db1=http://172.16.30.10:2380,db2=http://172.16.30.11:2380,db3=http://172.16.30.12:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="postgres-cluster"

sudo systemctl restart etcd

# /etc/patroni/patroni.yml
scope: postgres-cluster
namespace: /db/
name: db1

restapi:
  listen: 172.16.30.10:8008
  connect_address: 172.16.30.10:8008

etcd:
  hosts: 172.16.30.10:2379,172.16.30.11:2379,172.16.30.12:2379

bootstrap:
  dcs:
    ttl: 30
    loop_wait: 10
    retry_timeout: 10
    maximum_lag_on_failover: 1048576
    postgresql:
      use_pg_rewind: true
      parameters:
        max_connections: 500
        shared_buffers: 8GB
        effective_cache_size: 24GB
        maintenance_work_mem: 2GB
        checkpoint_completion_target: 0.9
        wal_buffers: 16MB
        default_statistics_target: 100
        random_page_cost: 1.1
        effective_io_concurrency: 200
        work_mem: 10MB
        min_wal_size: 1GB
        max_wal_size: 4GB
        max_worker_processes: 8
        max_parallel_workers_per_gather: 4
        max_parallel_workers: 8
        max_parallel_maintenance_workers: 4

  initdb:
    - encoding: UTF8
    - locale: en_US.UTF-8
    - data-checksums

  pg_hba:
    - host replication replicator 172.16.30.0/24 scram-sha-256
    - host all all 172.16.20.0/24 scram-sha-256
    - host all all 172.16.30.0/24 scram-sha-256
    - host all all 127.0.0.1/32 scram-sha-256

  users:
    admin:
      password: <admin-password>
      options:
        - createrole
        - createdb
    replicator:
      password: <replicator-password>
      options:
        - replication

postgresql:
  listen: 172.16.30.10:5432
  connect_address: 172.16.30.10:5432
  data_dir: /var/lib/postgresql/16/main
  bin_dir: /usr/lib/postgresql/16/bin
  pgpass: /tmp/pgpass
  authentication:
    replication:
      username: replicator
      password: <replicator-password>
    superuser:
      username: postgres
      password: <postgres-password>
  parameters:
    unix_socket_directories: '/var/run/postgresql'

tags:
    nofailover: false
    noloadbalance: false
    clonefrom: false
    nosync: false

# Create systemd service
sudo nano /etc/systemd/system/patroni.service

[Unit]
Description=Patroni PostgreSQL Cluster Manager
After=syslog.target network.target etcd.service

[Service]
Type=simple
User=postgres
Group=postgres
ExecStart=/usr/local/bin/patroni /etc/patroni/patroni.yml
ExecReload=/bin/kill -s HUP $MAINPID
KillMode=process
TimeoutSec=30
Restart=on-failure

[Install]
WantedBy=multi-user.target

# Stop PostgreSQL (managed by Patroni now)
sudo systemctl stop postgresql
sudo systemctl disable postgresql

# Start Patroni
sudo systemctl daemon-reload
sudo systemctl enable patroni
sudo systemctl start patroni

# Check cluster status
patronictl -c /etc/patroni/patroni.yml list

sudo apt install -y haproxy

sudo nano /etc/haproxy/haproxy.cfg

global
    maxconn 4096
    log /dev/log local0

defaults
    log global
    mode tcp
    option tcplog
    option dontlognull
    retries 3
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

listen postgres_cluster
    bind *:5000
    mode tcp
    option httpchk
    http-check expect status 200
    default-server inter 3s fall 3 rise 2 on-marked-down shutdown-sessions
    server db1 172.16.30.10:5432 maxconn 100 check port 8008
    server db2 172.16.30.11:5432 maxconn 100 check port 8008

listen postgres_replica
    bind *:5001
    mode tcp
    balance roundrobin
    option httpchk
    http-check expect status 200
    default-server inter 3s fall 3 rise 2 on-marked-down shutdown-sessions
    server db1 172.16.30.10:5432 maxconn 100 check port 8008
    server db2 172.16.30.11:5432 maxconn 100 check port 8008

listen stats
    bind *:7000
    mode http
    stats enable
    stats uri /
    stats refresh 30s

sudo systemctl restart haproxy

# On PostgreSQL
sudo -u postgres psql

CREATE DATABASE nextcloud;
CREATE USER nextcloud WITH ENCRYPTED PASSWORD '<nextcloud-db-password>';
GRANT ALL PRIVILEGES ON DATABASE nextcloud TO nextcloud;
\q

# Install web server and PHP
sudo apt install -y nginx php8.3-fpm php8.3-cli php8.3-common \
  php8.3-mysql php8.3-pgsql php8.3-zip php8.3-gd php8.3-mbstring \
  php8.3-curl php8.3-xml php8.3-bcmath php8.3-intl php8.3-imagick \
  php8.3-apcu php8.3-redis php8.3-gmp php8.3-bz2 \
  redis-server unzip

# Install recommended packages
sudo apt install -y ffmpeg libreoffice

cd /tmp
wget https://download.nextcloud.com/server/releases/nextcloud-28.0.0.tar.bz2
wget https://download.nextcloud.com/server/releases/nextcloud-28.0.0.tar.bz2.sha256

# Verify checksum
sha256sum -c nextcloud-28.0.0.tar.bz2.sha256 < nextcloud-28.0.0.tar.bz2

# Extract
sudo tar -xjf nextcloud-28.0.0.tar.bz2 -C /var/www/
sudo chown -R www-data:www-data /var/www/nextcloud

sudo nano /etc/php/8.3/fpm/php.ini

memory_limit = 512M
upload_max_filesize = 10G
post_max_size = 10G
max_execution_time = 3600
max_input_time = 3600
opcache.enable=1
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=10000
opcache.revalidate_freq=60
opcache.save_comments=1

sudo nano /etc/php/8.3/fpm/pool.d/www.conf

pm = dynamic
pm.max_children = 120
pm.start_servers = 12
pm.min_spare_servers = 6
pm.max_spare_servers = 18

sudo systemctl restart php8.3-fpm

sudo nano /etc/nginx/sites-available/nextcloud

upstream php-handler {
    server unix:/run/php/php8.3-fpm.sock;
}

server {
    listen 80;
    listen [::]:80;
    server_name cloud.company.com cloud.company.internal;

    # Add headers to serve security related headers
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Download-Options "noopen" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Permitted-Cross-Domain-Policies "none" always;
    add_header X-Robots-Tag "noindex, nofollow" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Path to the root of your installation
    root /var/www/nextcloud;

    # Specify how to handle directories
    location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
            return 302 /remote.php/webdav/$is_args$args;
        }
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # Make a regex exception for `/.well-known` so that clients can still
    # access it despite the existence of the regex rule
    location ^~ /.well-known {
        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }

        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

        return 301 /index.php$request_uri;
    }

    # Rules borrowed from `.htaccess` to hide certain paths from clients
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
    # which handle static assets (as seen below).
    location ~ \.php(?:$|/) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files $fastcgi_script_name =404;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;

        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass php-handler;

        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;

        fastcgi_read_timeout 3600;
        fastcgi_send_timeout 3600;
        fastcgi_connect_timeout 3600;
    }

    location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463, immutable";
        access_log off;
    }

    location ~ \.woff2?$ {
        try_files $uri /index.php$request_uri;
        expires 7d;
        access_log off;
    }

    # Rule borrowed from `.htaccess`
    location /remote {
        return 301 /remote.php$request_uri;
    }

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }
}

# Enable site
sudo ln -s /etc/nginx/sites-available/nextcloud /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx

cd /var/www/nextcloud
sudo -u www-data php occ maintenance:install \
  --database="pgsql" \
  --database-name="nextcloud" \
  --database-host="172.16.30.15:5000" \
  --database-user="nextcloud" \
  --database-pass="<nextcloud-db-password>" \
  --admin-user="admin" \
  --admin-pass="<admin-password>" \
  --data-dir="/var/www/nextcloud/data"

# Configure trusted domains
sudo -u www-data php occ config:system:set trusted_domains 0 --value=cloud.company.com
sudo -u www-data php occ config:system:set trusted_domains 1 --value=cloud.company.internal
sudo -u www-data php occ config:system:set trusted_domains 2 --value=172.16.20.20

# Configure Redis caching
sudo -u www-data php occ config:system:set redis host --value=172.16.30.20
sudo -u www-data php occ config:system:set redis port --value=6379
sudo -u www-data php occ config:system:set memcache.local --value='\\OC\\Memcache\\APCu'
sudo -u www-data php occ config:system:set memcache.distributed --value='\\OC\\Memcache\\Redis'
sudo -u www-data php occ config:system:set memcache.locking --value='\\OC\\Memcache\\Redis'

# Configure background jobs
sudo -u www-data php occ background:cron

# Add cron job
echo "*/5  *  *  *  * www-data php -f /var/www/nextcloud/cron.php" | sudo tee -a /etc/crontab

# Configure default phone region (adjust as needed)
sudo -u www-data php occ config:system:set default_phone_region --value="CA"

# Using Docker for Collabora
sudo docker run -d \
  --name collabora \
  --restart unless-stopped \
  -p 9980:9980 \
  -e "domain=cloud\\.company\\.com" \
  -e "username=admin" \
  -e "password=<collabora-admin-password>" \
  -e "extra_params=--o:ssl.enable=false --o:ssl.termination=true" \
  collabora/code

# Install Nextcloud Office app
sudo -u www-data php occ app:install richdocuments
sudo -u www-data php occ config:app:set richdocuments wopi_url --value="http://172.16.20.20:9980"

# Install LDAP app
sudo -u www-data php occ app:install user_ldap

# Configure via web UI or CLI
sudo -u www-data php occ ldap:create-empty-config
sudo -u www-data php occ ldap:set-config s01 ldapHost "ldap://ipa1.company.internal ldap://ipa2.company.internal"
sudo -u www-data php occ ldap:set-config s01 ldapPort 389
sudo -u www-data php occ ldap:set-config s01 ldapAgentName "uid=nextcloud,cn=users,cn=accounts,dc=company,dc=internal"
sudo -u www-data php occ ldap:set-config s01 ldapAgentPassword "<nextcloud-service-account-password>"
sudo -u www-data php occ ldap:set-config s01 ldapBase "cn=accounts,dc=company,dc=internal"
sudo -u www-data php occ ldap:set-config s01 ldapUserFilter "(&(objectClass=person)(uid=*))"
sudo -u www-data php occ ldap:set-config s01 ldapGroupFilter "(&(objectClass=groupOfNames)(cn=*))"
sudo -u www-data php occ ldap:set-config s01 ldapLoginFilter "(&(objectClass=person)(uid=%uid))"
sudo -u www-data php occ ldap:set-config s01 ldapEmailAttribute "mail"
sudo -u www-data php occ ldap:set-config s01 ldapUserDisplayName "displayName"
sudo -u www-data php occ ldap:set-config s01 ldapConfigurationActive 1

# Test LDAP connection
sudo -u www-data php occ ldap:test-config s01

# Productivity
sudo -u www-data php occ app:install calendar
sudo -u www-data php occ app:install contacts
sudo -u www-data php occ app:install tasks
sudo -u www-data php occ app:install deck
sudo -u www-data php occ app:install forms

# Communication
sudo -u www-data php occ app:install spreed  # Talk

# Files
sudo -u www-data php occ app:install files_pdfviewer
sudo -u www-data php occ app:install files_texteditor
sudo -u www-data php occ app:install files_markdown

# Security
sudo -u www-data php occ app:install twofactor_totp
sudo -u www-data php occ app:install end_to_end_encryption

# Admin tools
sudo -u www-data php occ app:install admin_audit
sudo -u www-data php occ app:install files_retention

# Set hostname
sudo hostnamectl set-hostname mail.company.com

# Update /etc/hosts
echo "172.16.20.10 mail.company.com mail" | sudo tee -a /etc/hosts

# Disable AppArmor (can interfere)
sudo systemctl stop apparmor
sudo systemctl disable apparmor

cd /tmp
wget https://github.com/iredmail/iRedMail/archive/1.6.8.tar.gz
tar -xzf 1.6.8.tar.gz
cd iRedMail-1.6.8

# Run installer
sudo bash iRedMail.sh

# Get configuration summary
cat /root/iRedMail-1.6.8/iRedMail.tips

# Get DKIM public key
sudo amavisd-new showkeys

# Add to DNS (see DNS Configuration section)

sudo ufw allow 25/tcp    # SMTP
sudo ufw allow 587/tcp   # SMTP Submission
sudo ufw allow 465/tcp   # SMTPS
sudo ufw allow 993/tcp   # IMAPS
sudo ufw allow 995/tcp   # POP3S
sudo ufw allow 80/tcp    # HTTP (redirect)
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable

# Add user
sudo bash /var/vmail/bin/create_mail_user_SQL.sh user1@company.com 'password'

# Add mail alias
sudo bash /var/vmail/bin/create_mail_alias_SQL.sh alias@company.com user1@company.com

sudo nano /etc/postfix/ldap/catchall_maps.cf

server_host = ipa1.company.internal ipa2.company.internal
server_port = 389
version = 3
bind = yes
start_tls = yes
bind_dn = uid=postfix,cn=sysaccounts,cn=etc,dc=company,dc=internal
bind_pw = <postfix-service-password>
search_base = cn=users,cn=accounts,dc=company,dc=internal
scope = sub
query_filter = (&(objectClass=person)(mail=%s))
result_attribute = mail

# Send test email
echo "Test email" | mail -s "Test Subject" user@external.com

# Check mail logs
sudo tail -f /var/log/mail.log

# On PostgreSQL
sudo -u postgres psql

CREATE DATABASE mattermost;
CREATE USER mattermost WITH ENCRYPTED PASSWORD '<mattermost-db-password>';
GRANT ALL PRIVILEGES ON DATABASE mattermost TO mattermost;
\q

# Download latest version
cd /tmp
wget https://releases.mattermost.com/9.3.0/mattermost-9.3.0-linux-amd64.tar.gz
tar -xzf mattermost-9.3.0-linux-amd64.tar.gz

# Move to /opt
sudo mv mattermost /opt/
sudo mkdir /opt/mattermost/data

# Create system user
sudo useradd --system --user-group mattermost
sudo chown -R mattermost:mattermost /opt/mattermost
sudo chmod -R g+w /opt/mattermost

sudo nano /opt/mattermost/config/config.json

{
  "ServiceSettings": {
    "SiteURL": "https://chat.company.com",
    "ListenAddress": ":8065",
    "EnableDeveloper": false,
    "EnableInsecureOutgoingConnections": false
  },
  "TeamSettings": {
    "SiteName": "Company Chat",
    "MaxUsersPerTeam": 500,
    "EnableTeamCreation": true,
    "EnableUserCreation": true
  },
  "SqlSettings": {
    "DriverName": "postgres",
    "DataSource": "postgres://mattermost:<password>@172.16.30.15:5000/mattermost?sslmode=disable&connect_timeout=10"
  },
  "FileSettings": {
    "Directory": "/opt/mattermost/data",
    "MaxFileSize": 104857600
  },
  "EmailSettings": {
    "EnableSignUpWithEmail": true,
    "EnableSignInWithEmail": true,
    "EnableSignInWithUsername": true,
    "SMTPServer": "mail.company.com",
    "SMTPPort": "587",
    "SMTPUsername": "noreply@company.com",
    "SMTPPassword": "<smtp-password>",
    "FeedbackEmail": "noreply@company.com",
    "ReplyToAddress": "noreply@company.com"
  },
  "LdapSettings": {
    "Enable": true,
    "LdapServer": "ipa1.company.internal",
    "LdapPort": 389,
    "BaseDN": "cn=users,cn=accounts,dc=company,dc=internal",
    "BindUsername": "uid=mattermost,cn=users,cn=accounts,dc=company,dc=internal",
    "BindPassword": "<mattermost-service-account-password>",
    "UserFilter": "(objectClass=person)",
    "EmailAttribute": "mail",
    "UsernameAttribute": "uid",
    "IdAttribute": "ipaUniqueID",
    "FirstNameAttribute": "givenName",
    "LastNameAttribute": "sn"
  },
  "SamlSettings": {
    "Enable": false
  }
}

sudo nano /etc/systemd/system/mattermost.service

[Unit]
Description=Mattermost
After=network.target postgresql.service

[Service]
Type=notify
ExecStart=/opt/mattermost/bin/mattermost
TimeoutStartSec=3600
KillMode=mixed
Restart=always
RestartSec=10
WorkingDirectory=/opt/mattermost
User=mattermost
Group=mattermost
LimitNOFILE=49152

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable mattermost
sudo systemctl start mattermost
sudo systemctl status mattermost

sudo nano /etc/nginx/sites-available/mattermost

upstream mattermost_backend {
    server 127.0.0.1:8065;
    keepalive 32;
}

server {
    listen 80;
    server_name chat.company.com chat.company.internal;

    location ~ /api/v[0-9]+/(users/)?websocket$ {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        client_max_body_size 50M;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Frame-Options SAMEORIGIN;
        proxy_buffers 256 16k;
        proxy_buffer_size 16k;
        client_body_timeout 60;
        send_timeout 300;
        lingering_timeout 5;
        proxy_connect_timeout 90;
        proxy_send_timeout 300;
        proxy_read_timeout 90s;
        proxy_http_version 1.1;
        proxy_pass http://mattermost_backend;
    }

    location / {
        client_max_body_size 50M;
        proxy_set_header Connection "";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Frame-Options SAMEORIGIN;
        proxy_buffers 256 16k;
        proxy_buffer_size 16k;
        proxy_read_timeout 600s;
        proxy_http_version 1.1;
        proxy_pass http://mattermost_backend;
    }
}

sudo ln -s /etc/nginx/sites-available/mattermost /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# Add Jitsi repository
curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/jitsi-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/" | sudo tee /etc/apt/sources.list.d/jitsi-stable.list

# Update and install
sudo apt update
sudo apt install -y jitsi-meet

# During installation:
# Hostname: meet.company.com
# SSL: Generate self-signed (we'll use Traefik for SSL termination)

# Main configuration
sudo nano /etc/jitsi/meet/meet.company.com-config.js

var config = {
    hosts: {
        domain: 'meet.company.com',
        muc: 'conference.meet.company.com'
    },
    bosh: '//meet.company.com/http-bind',
    websocket: 'wss://meet.company.com/xmpp-websocket',

    // Branding
    brandingDataUrl: '',
    defaultLogoUrl: 'images/logo.svg',

    // Feature flags
    enableWelcomePage: true,
    enableClosePage: false,
    disableThirdPartyRequests: true,

    // Authentication
    enableUserRolesBasedOnToken: false,

    // Recording
    fileRecordingsEnabled: true,
    liveStreamingEnabled: false,

    // P2P (disable for larger deployments)
    p2p: {
        enabled: false
    },

    // Resolution and quality
    resolution: 720,
    constraints: {
        video: {
            height: {
                ideal: 720,
                max: 1080,
                min: 240
            }
        }
    },

    // Other settings
    defaultLanguage: 'en',
    disableAudioLevels: false,
    enableNoisyMicDetection: true,
    startAudioOnly: false,
    startWithAudioMuted: false,
    startWithVideoMuted: false
};

sudo nano /etc/jitsi/videobridge/sip-communicator.properties

org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS=172.16.20.40
org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS=<Public-IP>
org.jitsi.videobridge.ENABLE_STATISTICS=true
org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.meet.company.com
org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
org.jitsi.videobridge.xmpp.user.shard.PASSWORD=<jvb-password>
org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.meet.company.com
org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=<unique-nickname>

sudo nano /etc/jitsi/jicofo/sip-communicator.properties

org.jitsi.jicofo.BRIDGE_MUC=JvbBrewery@internal.auth.meet.company.com

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 10000/udp  # Video/audio
sudo ufw allow 5347/tcp   # XMPP component
sudo ufw enable

sudo systemctl restart prosody
sudo systemctl restart jicofo
sudo systemctl restart jitsi-videobridge2

# Configure Prosody for internal authentication
sudo nano /etc/prosody/conf.avail/meet.company.com.cfg.lua

VirtualHost "meet.company.com"
    authentication = "internal_hashed"  # Change from 'anonymous'

VirtualHost "guest.meet.company.com"
    authentication = "anonymous"
    c2s_require_encryption = false

Component "conference.meet.company.com" "muc"
    restrict_room_creation = true
    storage = "memory"
    modules_enabled = {
        "muc_meeting_id";
        "muc_domain_mapper";
        "polls";
    }
    admins = { "focus@auth.meet.company.com" }
    muc_room_locking = false
    muc_room_default_public_jids = true

# Restart Prosody
sudo systemctl restart prosody

# Create users
sudo prosodyctl register <username> meet.company.com <password>

# On Nextcloud server
sudo -u www-data php occ app:install integration_jitsi

# Configure
sudo -u www-data php occ config:app:set integration_jitsi jitsi_url --value="https://meet.company.com"
sudo -u www-data php occ config:app:set integration_jitsi room_name_format --value="{user}-{timestamp}"

# On PostgreSQL
sudo -u postgres psql

CREATE DATABASE zammad_production;
CREATE USER zammad WITH ENCRYPTED PASSWORD '<zammad-db-password>';
GRANT ALL PRIVILEGES ON DATABASE zammad_production TO zammad;
\q

# Import GPG key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

# Install
sudo apt update
sudo apt install -y elasticsearch

# Configure
sudo nano /etc/elasticsearch/elasticsearch.yml

cluster.name: zammad
node.name: es1
network.host: 172.16.20.71
http.port: 9200
discovery.type: single-node
xpack.security.enabled: false

sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

# Test
curl http://172.16.20.71:9200

# Add Zammad repository
curl -fsSL https://dl.packager.io/srv/zammad/zammad/key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/pkgr-zammad.gpg> /dev/null
echo "deb [signed-by=/etc/apt/trusted.gpg.d/pkgr-zammad.gpg] https://dl.packager.io/srv/deb/zammad/zammad/stable/ubuntu 24.04 main"| sudo tee /etc/apt/sources.list.d/zammad.list > /dev/null

# Update and install
sudo apt update
sudo apt install -y zammad

# Configure database connection
sudo zammad config:set DATABASE_URL="postgresql://zammad:<password>@172.16.30.15:5000/zammad_production"

# Configure Elasticsearch
sudo zammad config:set ELASTICSEARCH_URL="http://172.16.20.71:9200"

# Run database migration
sudo zammad run rails db:migrate

# Build search index
sudo zammad run rake searchindex:rebuild

# Restart services
sudo systemctl restart zammad
sudo systemctl restart zammad-web
sudo systemctl restart zammad-worker

# Nginx configuration should be created automatically
sudo nginx -t
sudo systemctl reload nginx

Name: FreeIPA
Host: ipa1.company.internal
Port: 389
SSL: STARTTLS
Bind DN: uid=zammad,cn=users,cn=accounts,dc=company,dc=internal
Bind Password: <zammad-service-account-password>
Base DN: cn=users,cn=accounts,dc=company,dc=internal
User Filter: (objectClass=person)
UID Attribute: uid

User → Traefik → Application → Keycloak → FreeIPA

sudo -u www-data php occ app:install user_oidc
sudo -u www-data php occ user_oidc:provider Keycloak \
  --clientid=nextcloud \
  --clientsecret=<client-secret> \
  --discoveryuri=https://sso.company.com/realms/company/.well-known/openid-configuration

Nextcloud URL: https://cloud.company.com
Username: Integration account
Password/Token: (create app password in Nextcloud)

#!/bin/bash
# Provisions new user across all platforms

USERNAME=$1
EMAIL=$2
FIRST_NAME=$3
LAST_NAME=$4
PASSWORD=$5
GROUPS=$6

# FreeIPA
ipa user-add $USERNAME \
  --first="$FIRST_NAME" \
  --last="$LAST_NAME" \
  --email="$EMAIL" \
  --password <<< "$PASSWORD"

# Add to groups
for group in $GROUPS; do
  ipa group-add-member $group --users=$USERNAME
done

# Create email account (iRedMail)
bash /var/vmail/bin/create_mail_user_SQL.sh "$EMAIL" "$PASSWORD"

# Nextcloud (auto-provisioned via LDAP)

# Mattermost (auto-provisioned via LDAP on first login)

# Send welcome email
mail -s "Welcome to Company IT" "$EMAIL" <<EOF
Hello $FIRST_NAME,

Your account has been created:

Email: $EMAIL
Chat: https://chat.company.com
Files: https://cloud.company.com
Help Desk: https://desk.company.com

Please log in and change your password.

Regards,
IT Team
EOF

echo "User $USERNAME provisioned successfully"

sudo chmod +x /usr/local/bin/provision-user.sh

sudo nano /etc/ssh/sshd_config

# Disable root login
PermitRootLogin no

# Disable password authentication (use keys only)
PasswordAuthentication no
PubkeyAuthentication yes

# Only allow specific users/groups
AllowUsers admin
AllowGroups ssh-users

# Strong ciphers only
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

# Other settings
X11Forwarding no
MaxAuthTries 3
MaxSessions 2
ClientAliveInterval 300
ClientAliveCountMax 2

sudo systemctl restart sshd

# Set defaults
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH from management VLAN only
sudo ufw allow from 172.16.10.0/24 to any port 22

# Allow specific services (example for web server)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable logging
sudo ufw logging on

# Enable firewall
sudo ufw enable

sudo apt install -y fail2ban

sudo nano /etc/fail2ban/jail.local

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
destemail = security@company.com
sendername = Fail2Ban
action = %(action_mwl)s

[sshd]
enabled = true
port = ssh
logpath = /var/log/auth.log

[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log

[nginx-noscript]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log

[nginx-badbots]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log

[postfix]
enabled = true
port = smtp,ssmtp,submission
logpath = /var/log/mail.log

[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps,submission
logpath = /var/log/mail.log

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

sudo apt install -y unattended-upgrades apt-listchanges

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};

Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::MinimalSteps "true";
Unattended-Upgrade::InstallOnShutdown "false";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

Unattended-Upgrade::Mail "sysadmin@company.com";
Unattended-Upgrade::MailReport "on-change";

sudo dpkg-reconfigure -plow unattended-upgrades

sudo apt install -y auditd audispd-plugins

sudo nano /etc/audit/rules.d/audit.rules

# Delete all existing rules
-D

# Buffer size
-b 8192

# Failure mode (1 = print failure message, 2 = panic)
-f 1

# Monitor file changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k actions
-w /etc/ssh/sshd_config -p wa -k sshd

# Monitor authentication
-w /var/log/auth.log -p wa -k auth
-w /var/log/faillog -p wa -k auth

# Monitor network changes
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications
-w /etc/hosts -p wa -k network_modifications
-w /etc/network/ -p wa -k network_modifications

# Monitor user/group changes
-w /usr/sbin/useradd -p x -k user_modification
-w /usr/sbin/userdel -p x -k user_modification
-w /usr/sbin/usermod -p x -k user_modification
-w /usr/sbin/groupadd -p x -k group_modification
-w /usr/sbin/groupdel -p x -k group_modification

# Monitor privilege escalation
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k priv_esc
-w /usr/bin/sudo -p x -k priv_esc